IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re Application of: § Attorney Docket No. RSW920040017US1 

Denilson Nastacio et al. § 

§ 

Serial No.: 10/809,175 § Examiner: Lindsey, Matthew S. 

§ 

Filed: March 25, 2004 § Art Unit: 2151 

§ 

For: METHOD, SYSTEMS AND § Confirmation No.: 6802 

COMPUTER PROGRAM PRODUCT § 
FOR GENERATING EVENTS HAVING § 
A COMMON EVENT FORMAT § 



APPEAL BRIEF UNDER 37 C.F.R. 41.37 



Mail Stop Appeal Briefs - Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 



Sir: 

This Appeal Brief is submitted in support of the Notice of Appeal filed August 14, 2008, 
and in response to the final rejection of claims 1, 3-5, 8, 10, and 11 in the above-identified 
application. 
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REAL PARTY IN INTEREST 

The real party in interest in the present Appeal is International Business Machines 
Corporation, the Assignee of the present application. 

RELATED APPEALS AND INTERFERENCES 

No appeals, interferences, or judicial proceedings are known to Appellants, the 
Appellants' legal representative, or Assignee, which may be related to, directly affect, or would 
be directly affected by or have a bearing on the Board's decision in the pending Appeal. 

STATUS OF CLAIMS 

Claims 1, 3-5, 8, 10, and 11 stand finally rejected under 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Patent Application Publication No. 2003/0200486 (hereinafter 
"Marwaha") in view of U.S. Patent No. 6,584,502 (hereinafter "Natarajan") as noted in the Final 
Office Action of May 14, 2008 (and as maintained in the Advisory Action of July 11, 2008). 
Claims 2, 6, 7, 9, and 12-30 have been canceled. The rejection of claims 1, 3-5, 8, 10, and 11 
under 35 U.S.C. § 103(a) is appealed 

STATUS OF AMENDMENTS 

An after-final amendment that was filed on June 15, 2008 (which canceled claims 12, 14- 
16, 18, 19, 21, 23-25, and 28-30) was entered. Claims 2, 6, 7, 9, 13, 17, 20, 22, 26, and 27 were 
previously canceled in an amendment filed March 20, 2008. 

SUMMARY OF CLAIMED SUBJECT MATTER 

Independent claim 1 is directed to a method of generating events having a common event 
format (see page 11, line 23 through page 15, line 25). With reference to Fig. 3, the method 
includes associating an event factory (300) with a directory service (see page 11, lines 26-28). 
The event factory (300) is then located using the directory service (see page 11, lines 28-29). A 
content handler (301) is associated with the event factory (300) (see page 11, line 29 through 
page 12, line 1). A common base event (340), associated with the content handler (301), is then 
obtained. The common base event (340) is populated with source specific situation information 
to provide a populated base event (see page 12, lines 1-9). The populated base event 
incorporated in the content handler (301) is returned from the event factory (300) to an event 
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source (305). It is then determined if a format of the populated base event conforms to a 
predefined event format that is defined by the content handler (301). A common event format 
representation of the populated base event is generated based on the predefined event format if 
the format of the populated base event does not conform to the predefined event format (see page 
14, lines 21-26). 

GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

Whether claims 1 5 3-5, 8, 10, and 11 are patentable under 35 U.S.C. § 103(a) over 
Marwaha in view of Natarajan. 

ARGUMENT 

REJECTION OF CLAIMS 1, 3-5, 8, 10, AND 11 UNDER 35 U.S.C. S 103(a) 

At page 2 of the Final Office Action, claims 1 ? 3-5, 8, 10, and 11 were rejected under 35 
U.S.C. § 103(a) over Marwaha in view of Nataxajan. The rejection of claims 1, 3-5, 8, 10, and 
11 under 35 U.S.C. § 103(a) is not well founded and should be reversed for at least the reason 
that the combination of Marwaha and Natarajan does not teach or suggest all of the features set 
forth in Appellants' independent claim 1. To establish prima facie obviousness of a claimed 
invention, all the claim limitations must be taught or suggested by the prior art. In re Royka, 490 
F.2d 981, 180 USPQ 580 (CCPA 1974). "All words in a claim must be considered in judging 
the patentability of that claim against the prior art." In re Wilson, 424 F.2d 1382, 1385, 165 
USPQ 494, 496 (CCPA 1970). If an independent claim is nonobvious under 35 U.S.C. § 103, 
then any claim depending therefrom is nonobvious. In re Fines, 837 F.2d 1071, 5 USPQ2d 1596 
(Fed. Cir. 1988). 

Independent Claim 1 

At the outset, Appellants submit that Marwaha (see, for example, Marwaha Figs. 2, 3, and 
10) merely discloses converting a received event to a common event format, irrespective of a 
format of the received event (see, for example, paragraph [0011]). With reference to Marwaha 
Fig. 2, a listener/receiver 202 is shown as providing input to a data normalization transformer 
204. With reference to Marwaha Fig. 3, each listener/receiver 302 is shown providing input to a 
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common event format (CEF) translator 304. Similarly, with reference to Fig. 10, each 
listener/receiver 1002 is shown as providing input to a CEF translator 1004. In contrast, 
Appellants' claimed subject matter as set forth in independent claim 1 only converts a received 
event to a common event format when the received event is not already in the common event 
format. 

In rejecting the above argument, the final Office Action stated (at page 14) "Marwaha 
discloses: The following tables show examples of the tokens and their values that may be 
updated 5 ([0027], lines 1-2), and see the table below [0027], OriginDateTime, Remarks, 'If the 
original date/time is present, then that may be used'. Therefore, the process of normalization 
includes determining whether the format is acceptable. If the format it acceptable, the system 
uses that value, if the format is not acceptable the normalization phase will update the value." In 
further support of the rejection, the Advisory Action (at page 2) stated "Marwaha disclosed: 
"Common event format includes a set of tokens, which contain essential information coming 
from different sources into an enterprise manage' ([001 1], lines 4-6). Marwaha further disclosed 
examples of these tokens, The following tables show examples of the tokens and their values 
that may be updated during the normalization phase' ([0027], lines 1-3, emphasis added). 
Tokens and their values may be updated during the normalization phase, thus tokens and their 
values are not always updated during the normalization phase. The table below [0027], 
specifically the OriginDateTime, Remarks section states "If the original date/time is present then 
that may be used'. If the original date/time is present then the value is not updated, and the 
original date/time is used." 

Appellants submit that the Examiner has misconstrued Marwaha paragraph [0027] and the 
table that follows paragraph [0027]. As is set forth in Marwaha, see, for example, paragraph 
[0025], "[i]n [a] data normalization phase, alert messages are translated into a common message 
string... The data normalization transformer 204 typically gathers information such as the source, 
type and status of a problem associated with an alert message." Moreover, Marwaha (see, for 
example, paragraph [0011]) states a "common event format includes a set of tokens, which 
contain essential information coming from different sources into an enterprise manager. For 
example, token 'domainClass' may include the type of domain the alert is associated with, such 
as MVS and Solaris, while token 'domain' may include the specific source of the alert such as 
MVSD and Apollo." With reference to Marwaha paragraph [0027], the permissive language 
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"tokens and their values that may be updated or assigned values" means when information is 
included in an incoming alert that is associated with one or more tokens, the tokens associated 
with the information are updated or assigned values. Similarly, when information is not included 
in the incoming alert that is associated with a token, the token is not typically utilized. As is 
specifically noted in paragraph [0027], "not all of the following tokens may be defined during 
this phase, or additional tokens may be defined during this phase." With respect to the 
OriginDateTime, Remarks, Appellants submit that the remarks mean if the original date/time 
(provided by an event originator) is present the value may be used or a date/time added by a 
connecting agent may be used (e.g., when the event originator has not included an original 
date/time for an event). As specifically noted in Marwaha paragraph [0028], a common event 
format (CEF) translator is utilized to extract the tokens and format information in the tokens in a 
common event format. In sum, the Examiner appears to confuse a format of information with a 
value for the information. As noted above, Marwaha merely discloses converting a received 
event to a common event format, irrespective of a format of the received event. 

With reference to Appellants 5 Fig. 3 and independent claim 1, Appellants agree that 
Marwaha does not teach or suggest, associating an event factory with a directory service, 
locating the event factory using the directory service, or returning a populated base event 
incorporated in a content handler from the event factory to an event source (see final Office 
Action at page 3). Moreover, with reference to Appellants Fig. 3, Appellants submit that 
Natarajan also does not teach or suggest (alone or in combination with Marwaha) a method that 
employs an event source (e.g., 305) that accesses an event factory (e.g., 300) to obtain a common 
base event (e.g., 340) that is populated and returned to the event source (in the form of a 
populated based event incorporated in a content handler). 

In rejecting the above argument, the Advisory Action (at page 3) stated "Natarajan 
disclosed: 'The information which is reported to the data store 252 is analyzed by a policy engine 
254. The policy engine 254 includes a plurality of application specific plug-in policies for 
analyzing application specific information from the data store and for computing updated control 
information based upon the analysis of the information. The updated control information may 
include any type of information, parameters, and/or actions which may be used to affect the 
operation of one or more network elements. The updated control information is then fed back to 
selected network elements (returned to the event source) to thereby affect operation of the 
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selected elements and/or network 5 (Col. 7, lines 19-29). Natarajan further disclosed: 'examples 
of the information reported by the network element may include information relating to: 
committed information rate (CIR), excess information rate (EIR), committed burst size (Be), 
excess burst size (Be), congestion indicators (e.g., discarded eligibility bits), number of packets 
dropped (e.g., during a given time interval), queue length at selected circuits within the network 
element, etc. Further, any of the above described parameters may be dynamically and 
automatically modified or updated by the policy engine and fed back to desired network elements 
for affecting the operation or performance of the network" (Col. 8, lines 40-51, emphasis added). 
The parameters reported by the network element may be dynamically and automatically 
modified or updated by the policy engine and fed back to desired network elements." 

In the above cited passage, the Examiner appears to erroneously equate the Natarajan 
policy engine with Appellants' event factory and the Natarajan network element with 
Appellants' event source. Appellants submit that neither Natarajan or Marwaha teach or suggest 
utilization of an event factory. With respect to Natarajan (column 7, lines 19-29), Appellants 
submit that while policy engine 254 may feed back control information to network elements 204 
to control the network elements 204, this does not teach or suggest an event source that accesses 
an event factory to obtain a common base event. Nor does it teach or suggest returning a 
populated base event from an event factory to an event source as Natarajan merely discloses 
providing control information (from a policy engine) to a network element based on information 
reported by the network element (to the policy engine). 

Moreover, it is still unclear to Appellants why one of ordinary skill in the art would be 
motivated by the combination of Marwaha and Natarajan to send a populated base event from an 
event factory to an event source. In responding to the above argument the Advisory Action 
stated "[mjotivation comes from Natarajan, The updated control information is fed back to 
selected network elements to thereby affect operation of the selected elements' (Abstract, lines 9- 
11). Natarajan disclosed: 'examples of the information reported by the network element may 
include information relating to: committed information rate (CIR), excess information rate (EIR), 
committed burst size (Be), excess burst size (Be), congestion indicators (e.g., discarded 
eligibility bits), number of packets dropped (e.g., during a given time interval), queue length at 
selected circuits within the network element, etc. Further, any of the above described parameters 
may be dynamically and automatically modified or updated by the policy engine and fed back to 
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desired network elements for affecting the operation or performance of the network' (Col. 8, 
lines 40-51, emphasis added). The reported information, or events, are updated and fed back to 
the network elements for affecting the operation or performance of the network." 

As noted above, Marwaha does not disclose an event factory that services multiple event 
sources (that is, each Marwaha listener/receiver has a corresponding CEF translator) and while 
Natarajan does disclose a policy engine that controls network elements according to rules built 
into the policy engine, Natarajan is feeding back control signals and not a populated base event 
and the Natarajan policy engine is not an event factory that populates a common base event with 
source specific information to provide a populated base event that is returned to an event source. 
In sum, the Examiner appears to confuse control information with a populated base event (that 
provides a basis for generating a common event format representation, if the populated base 
event does not conform to a predefined event format). 

In sum, Appellants submit that none of the applied art of record (alone or in combination) 
teaches or suggests a method that includes an event source that accesses an event factory to 
obtain a common base event that is populated and returned to the event source (in the form of a 
populated based event incorporated in a content handler). 

For at least the reasons set forth above, Appellants respectfully submit that Appellants' 
independent claim 1 is allowable over the applied art of record. 

Dependent Claims 3-5. 8. 10, and 11 

Appellants submit that dependent claims 3-5, 8, 10, and 1 1 are also allowable for at least 
the reason that the claims depend on allowable claims. 
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CONCLUSION 

The foregoing remarks demonstrate that the combination of Marwaha and Natarajan does 
not teach or suggest each feature of claims 1, 3-5, 8, 10, and 1 1 as required to support a rejection 
under 35 U.S.C. § 103(a). Appellants therefore request that the Board overturn the rejection of 
claims 1, 3-5, 8, 10, and 11 under 35 U.S.C. § 103(a). 

In conjunction herewith, Appellants have submitted the fee for the filing of this Appeal 
Brief. No additional fee is believed to be required. If, however, any additional fees are required, 
please charge those fees to IBM Corporation Deposit Account No. 09-0447. 



Respectfully submitted, 

Michael R. Long 
Reg. No. 42,808 
Dillon & Yudell llp 
891 1 N. Capital of Texas Hwy., Suite 21 10 
Austin, Texas 78759 
(512) 343-6116 

ATTORNEY FOR APPELLANTS 
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CLAIMS APPENDIX 

1. A method of generating events having a common event format, comprising: 
associating an event factory with a directory service; 

locating the event factory using the directory service; 
associating a content handler with the event factory; 
obtaining a common base event associated with the content handler; 
populating the common base event with source specific situation information to provide a 
populated base event; 

returning the populated base event incorporated in the content handler from the event factory 
to the event source; 

determining if a format of the populated base event conforms to a predefined event format, 
wherein the predefined event format is defined by the content handler; and 

generating a common event format representation of the populated base event based on the 
predefined event format if the format of the populated base event does not conform to the 
predefined event format. 

2. (Canceled) 
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3. The method of claim 1, wherein the source specific situation information is provided in a 
plurality of event fields and wherein the generating a common event format representation of the 
populated base event comprises: 

determining if ones of the plurality of event fields conform to the predefined event format 
defined by the content handler; 

modifying the format of the ones of the plurality of event fields that do not conform to the 
predefined event format; 

determining if ones of the plurality of event fields are empty; and 

populating the empty ones of the plurality of event fields with source specific situation 
information based on the predefined event format. 

4. The method of claim 3, further comprising: 

providing the common event format representation of the populated base event to an event 
server; and 

storing the common event format representation of the populated base event in a data store at 
the event server. 

5. The method of claim 4, further comprising: 

querying the event server to obtain status information of a system associated with the event 
source based on the stored common event format representation of the populated base event. 

6-7. (Canceled) 
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8. The method of claim 1, wherein the directory service comprises a Java Naming and 
Directory(JNDI) service. 



9. (Canceled) 



10. The method of claim 1 , wherein the populated base event comprises a date and/or time 
stamp, a situation type, an identity of the event source and/or an identity of a component 
reporting the situation type. 

11. The method of claim 1 ? wherein generating comprises automatically generating a common 
event format representation of the populated base event based on the predefined event format. 



12-30. (Canceled) 
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EVIDENCE APPENDIX 
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RELATED PROCEEDINGS APPENDIX 

None. 
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